CVE-2023-40530

Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478	Product
https://jvn.jp/en/jp/JVN03447226/	Third Party Advisory
https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto	Product
https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478	Product
https://jvn.jp/en/jp/JVN03447226/	Third Party Advisory
https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:skylark:skylark::::::android::*
	cpe:2.3:a:skylark:skylark::::::iphone_os::*

History

21 Nov 2024, 08:19

Type	Values Removed	Values Added
References	~~() https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478 - Product~~	() https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478 - Product
References	~~() https://jvn.jp/en/jp/JVN03447226/ - Third Party Advisory~~	() https://jvn.jp/en/jp/JVN03447226/ - Third Party Advisory
References	~~() https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto - Product~~	() https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto - Product

31 Aug 2023, 16:29

Type	Values Removed	Values Added
CWE		CWE-862
CPE		cpe:2.3:a:skylark:skylark::::::android::* cpe:2.3:a:skylark:skylark::::::iphone_os::*
First Time		Skylark skylark Skylark
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.7
References	~~(MISC) https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478 -~~	(MISC) https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478 - Product
References	~~(MISC) https://jvn.jp/en/jp/JVN03447226/ -~~	(MISC) https://jvn.jp/en/jp/JVN03447226/ - Third Party Advisory
References	~~(MISC) https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto -~~	(MISC) https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto - Product

25 Aug 2023, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-25 04:15

Updated : 2024-11-21 08:19

NVD link : CVE-2023-40530

Mitre link : CVE-2023-40530

CVE.ORG link : CVE-2023-40530

JSON object : View

Products Affected

skylark

skylark

CWE

CWE-862

Missing Authorization

4.7 /10